Privacy policy

This policy applies to personal data we handle when:

• you visit risklens360.com or any page we operate;
• you contact us by WhatsApp, email, phone, a web form or in person;
• you are a user of the platform on behalf of one of our clients;
• your organisation is, or is considering becoming, a client or partner; and
• our clients process information about their own customers through the platform or our API.

It does not cover websites or services run by others, including our clients' own websites and the messaging apps you use to contact us, which have their own privacy policies.

Data protection law distinguishes between the party that decides why and how personal data is used (the controller) and the party that processes it on that party's instructions (the processor). We act in both roles, depending on the data.

• We are the controller for data about website visitors, people who contact us, prospective and existing clients, platform users' account details, billing, and our own marketing.
• We are a processor for data that a client enters into, uploads to, or sends through the platform or API about its customers, their shareholders, beneficial owners, representatives and counterparties. The client is the controller of that data and decides what is processed and why. We process it only to provide our services and on the client's documented instructions.
• AML service providers who use the platform for their own clients usually act as processors for those clients. In that case we act as their sub-processor, and the service provider is responsible for having the authority and instructions it needs from each client.

We also act as an independent controller for a limited set of activities around the platform: keeping it secure, preventing fraud and misuse, maintaining system logs, and creating anonymised or aggregated information that no longer identifies any person or client.

If your data is held in the platform by one of our clients, that client is your first point of contact. Their own privacy notice explains how they use your information.

We handle personal data in line with UAE Federal Decree Law No. 45 of 2021 on the Protection of Personal Data and its implementing rules, and with the other laws that apply to the data in question. In particular:

• Some data is governed by its own legislation rather than, or in addition to, the federal data protection law, for example banking and credit information of clients regulated as financial institutions.
• Clients established in a financial free zone such as the Dubai International Financial Centre or Abu Dhabi Global Market are subject to that free zone's own data protection law.
• UAE anti-money laundering law, including Federal Decree Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025, requires regulated businesses to collect, keep and in some cases report customer information. Those obligations can override individual requests, as explained below.
• Where a foreign law such as the EU General Data Protection Regulation applies, we respect it too.

When you contact us or request a demo: your name, company, job role, work email, WhatsApp or phone number, the type and size of your business, and anything you choose to tell us.

When you message us on WhatsApp: your WhatsApp number and profile name, the messages and files you send, and the reference code included in messages started from our website.

About clients and platform users: names, work contact details, job roles, login credentials (stored in protected form), user permissions, activity within the platform, support requests, contract and billing details.

Processed in the platform for our clients: depending on how a client uses it, this can include names, dates of birth, nationalities, identity and passport details, addresses, photographs and copies of identity documents, company and trade licence details, shareholders and beneficial owners, source of funds and wealth information, transaction details, risk ratings, screening results, case notes, and reports prepared by the client.

Sensitive personal data: screening against sanctions and watch lists and the client's own checks may reveal information that the law treats as sensitive, such as criminal records. We process it only as part of the services the client has asked for, and only where the client's legal obligations require or permit it.

From other sources: official sanctions and watch lists published by governments and international bodies, public registers, and information clients obtain and provide to us.

Technical data: browser and device type, pages viewed, approximate location derived from your internet address, and campaign information from the link you arrived on, as described in the section on cookies, local storage and analytics.

Screening compares names against lists published by governments and international bodies, such as the United Nations Security Council, the UAE Local Terrorist List, the US Office of Foreign Assets Control and the European Union, and against watch lists and blacklists that a client maintains itself. These lists contain names and identifying details of people who may never have dealt with us or our clients.

• Where we hold copies of official lists to run screening, we use that information only to help regulated businesses meet their legal obligations, which is a public interest purpose, and for no other reason.
• We do not add to, edit or remove entries in official lists.
• If you believe you have been listed in error, you need to apply to the authority that published the list, such as the Executive Office for Control and Non-Proliferation for UAE lists, because neither we nor our clients can remove or change an official designation. Once an authority removes an entry, it drops out of screening when the updated list is loaded.
• A client's own internal watch list, blacklist or whitelist is controlled by that client, and questions about it should go to the client.

We use personal data only for clear purposes, and only where the law allows it:

• To respond to enquiries, arrange demos and prepare proposals, at your request and to take steps before entering into an agreement.
• To provide the platform, API and support to clients, because it is necessary to perform our agreement with them.
• To process client customer data on the client's instructions, so that the client can meet obligations imposed on it by UAE anti-money laundering and sanctions laws.
• To keep our services secure, prevent misuse and fraud, and investigate incidents.
• To meet our own legal obligations, such as tax, accounting and lawful requests from competent authorities.
• To establish, exercise or defend legal claims.
• To send business updates and marketing to clients and contacts, with consent where it is required. You can opt out at any time.
• To understand which of our marketing works, using aggregated or campaign-level information.

We do not sell personal data, and we never use client customer data for our own marketing.

The platform compares names and details against lists and suggests potential matches, match scores and risk ratings. These outputs support the client's decision making. They are designed to be reviewed by the client's trained staff, and the client, not RiskLens360, decides whether a match is genuine, what risk rating applies, and what action to take.

Where a decision based solely on automated processing would have legal or similarly significant effects on a person, the client is responsible for making sure a human reviews it and that the person can exercise any right to object that applies.

• Service providers who help us run our business, such as cloud hosting, data storage, email, customer support, analytics and messaging providers. They may only use the data to provide their service to us, under written terms that require them to protect it.
• WhatsApp, operated by Meta, when you choose to message us there. Meta handles those messages under its own terms and privacy policy.
• Screening data providers, where a check requires sending search terms to a list or data provider.
• Competent authorities, regulators, courts and law enforcement, where the law requires it or to protect our rights.
• Professional advisers such as lawyers, auditors and insurers, under duties of confidentiality.
• A buyer or successor if our business is reorganised, merged or sold, subject to this policy.

We do not share one client's data with another client. Client customer data is shared only as that client instructs, or as the law requires.

UAE law treats information about suspicious transactions as confidential (Federal Decree Law No. 10 of 2025, Article 24). It is a criminal offence to warn or notify a person, to disclose information about transactions under review as suspicious, or to reveal that the authorities are making inquiries or investigating (Article 29). The penalty is imprisonment, a fine of at least AED 50,000, or both, and more where proceeds are lost as a result.

Because of this:

• we do not tell anyone whether a client has screened them, found a match, raised a case, or filed a report;
• if we receive a request about data a client holds, we pass it to that client without confirming or denying what the platform contains; and
• our clients, and we, may have to refuse or limit a request for information, access or deletion where answering it could reveal a report or investigation, prejudice legal proceedings, or conflict with a legal obligation.

Some of our service providers may store or process personal data outside the UAE. We transfer personal data abroad only where the law allows it, for example to countries with an adequate level of data protection, or under a written contract that requires the recipient to apply protections equivalent to those required under UAE law. Clients can ask us which locations apply to their data.

Where a client is established outside the UAE, or processes data about people in another country, the data protection law of that country may also apply, such as the EU or UK General Data Protection Regulation. In that case we support the client in meeting those requirements, including through a data processing agreement and appropriate transfer safeguards, and individuals have the rights that law gives them in addition to the rights described here.

We keep personal data only as long as it is needed for the purpose it was collected for, or as long as the law requires. When it is no longer needed, we delete it or anonymise it so that no one can be identified from it.

• Enquiries and demo requests that do not lead to an agreement: up to 2 years after our last contact, unless you ask us to delete them sooner.
• Client, user account and billing records: for the duration of the agreement, and afterwards for as long as needed to meet tax, accounting and legal requirements and to deal with any claims.
• Client customer data in the platform: as instructed by the client. UAE regulated businesses must keep customer due diligence records, transaction records and related documents for no less than five years from the end of the business relationship or the completed transaction, and in some cases from the end of an inspection by their supervisor (Cabinet Resolution No. 134 of 2025, Article 25). For this reason, a person's request to delete that data will usually have to be refused by the client until the retention period has passed. When a client's agreement with us ends, we return or delete its data as set out in our terms and the client agreement.
• Backups are overwritten on a rolling schedule and are not used for any other purpose in the meantime.

We use technical and organisational measures suited to the sensitivity of compliance data, which can include encryption, access controls based on user roles, logging of user activity, separation of client data, secure development practices, staff confidentiality obligations and regular review of these measures.

No system is completely secure. If a personal data breach occurs that is likely to affect the privacy, confidentiality or security of personal data, we will act promptly to contain it, notify affected clients without undue delay, and report it to the UAE Data Office and to individuals where the law requires.

Subject to the conditions and exceptions in the law, you have the right to:

• obtain information about the personal data we process about you, why, who it is shared with and how long it is kept, free of charge;
• receive personal data you provided to us in a structured, machine readable format, and ask for it to be transferred to another controller where technically feasible;
• ask us to correct or complete inaccurate data;
• ask us to delete your data;
• ask us to restrict or stop processing, including objecting to direct marketing at any time;
• object to decisions based on automated processing that have legal or serious effects on you;
• withdraw consent where we rely on it, without affecting processing already carried out; and
• complain to the UAE Data Office.

Limits on these rights. The law allows requests to be refused or limited where, for example, erasure would conflict with other legislation the controller is subject to, where a request would affect an investigation or legal proceedings, where it would affect the privacy of other people, or where requests are repetitive or unrelated. Anti-money laundering record keeping obligations are the most common reason a deletion request cannot be met straight away. If we refuse a request, we will tell you why where the law allows us to.

Data held by our clients. If your request concerns data a client processes in the platform, we will pass it to that client and support them in responding, as they decide how to handle it.

How to make a request. Contact us at info@risklens360.com. We may need to verify your identity before acting on a request, and we aim to respond within 30 days.

We send business updates and marketing only to business contacts, and only where the law allows. Every message tells you how to opt out, and you can also write to info@risklens360.com. Opting out does not affect messages we need to send about an existing agreement or service.

When you arrive from a link that carries campaign details (such as utm parameters or an advertising click identifier), the website stores those details in your browser's local storage for up to 90 days. When you then contact us on WhatsApp, a reference code is added to your message so we know which campaign led to your enquiry.

When you click a WhatsApp button, we also record that click in our own database: the reference code, which button and page it came from, the campaign details above, and the time. That record does not identify you and holds no name, number, address or message content. We keep these click records for up to 24 months so we can tell which campaigns and pages produce enquiries.

Where we use web analytics, such as Google Analytics, it collects information about how the website is used. You can clear local storage and cookies at any time through your browser settings, and most browsers let you block them.

Our website and services are intended for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children through the website. Client customer data may include minors where a client's obligations require it, in which case the client is responsible for that processing.

Our website may link to other websites and services. We are not responsible for their content or privacy practices, and we recommend reading their privacy policies.

If you have a concern about how we handle personal data, please contact us first at info@risklens360.com so we can try to resolve it. You also have the right to file a complaint with the UAE Data Office, or with the data protection authority of a free zone where that authority is responsible.

We may update this policy to reflect changes in our services or the law. The date at the top shows when it was last updated. Where changes are significant, we will take reasonable steps to let clients know.

Muhammad Arqam, Dubai, UAE. Email info@risklens360.com, or call +971 52 634 3446.